ENCFORGE Ransomware Targets PyTorch, SafeTensors Model Files
July 28, 2026
Sysdig documented ENCFORGE, a Go ransomware targeting 180 AI file formats including PyTorch, SafeTensors, and GGUF, deployed by the JADEPUFFER
Cybersecurity
ENCFORGE Ransomware Targets PyTorch, SafeTensors Model Files
Sysdig documented ENCFORGE, a Go ransomware targeting 180 AI file formats including PyTorch, SafeTensors, and GGUF, deployed by the JADEPUFFER threat operator.
Fastjson 1.x Zero-Day CVE-2026-16723 Under Active Exploit, No Patch
CVE-2026-16723, a CVSS 9.0 zero-day in Fastjson 1.x with no available patch, is actively exploited targeting financial services and healthcare backends.
CISA Orders Patch for Langflow and WordPress wp2shell RCEs
CISA added Langflow CVE-2026-0770 and WordPress wp2shell CVE-2026-63030 to its KEV catalog, setting a July 24 Langflow deadline and August 4 WordPress deadline as mass ...
Qilin Affiliates Exploit PAN-OS CVE-2026-0257 GlobalProtect Bypass
Arctic Wolf documented Qilin affiliates exploiting CVE-2026-0257, a PAN-OS GlobalProtect auth bypass, to gain trusted VPN access for double-extortion attacks.
JetBrains Patches TeamCity CVE-2026-63077 CVSS 9.8 RCE Flaw
JetBrains patched CVE-2026-63077, a CVSS 9.8 unauthenticated RCE in TeamCity CI/CD servers exploitable via the agent polling protocol without any credentials.
AI-Assisted Linux Kernel CVE-2026-53264 Root Exploit Released
Lee Jia Jie used AI assistance to discover CVE-2026-53264, a Linux kernel use-after-free enabling local root escalation. A public exploit is now available.
Arista VeloCloud CVE-2026-16812 Exploited, CISA Orders Patch
Arista confirmed CVE-2026-16812, a CVSS 10.0 OS command injection in VeloCloud Orchestrator, is actively exploited. CISA ordered federal patches by July 30.
Dysphoria IoT Botnet Hits 200K Devices With Blockchain C2
Dysphoria, successor to the disrupted JackSkid botnet, infected 200,000 IoT devices worldwide and adopted Ethereum and Solana Name Service to anchor its C2.
Public Exploit Released for vBulletin CVE-2026-61511 RCE
SSD Secure Disclosure released a weaponized unauthenticated RCE exploit for CVE-2026-61511 in vBulletin 6.x, exposing forum sites not yet on version 6.2.2.
n8n Sandbox Escape GHSA-gv7g-jm28-cr3m Exposes Host OS Commands
n8n versions before 2.31.5 let authenticated users escape the expression sandbox via arrow functions and Reflect.get(), executing OS commands on the host.
Fastjson 1.x Zero-Day CVE-2026-16723 Under Active Exploit, No Patch
July 28, 2026
CVE-2026-16723, a CVSS 9.0 zero-day in Fastjson 1.x with no available patch, is actively exploited targeting financial services and healthcare
CISA Orders Patch for Langflow and WordPress wp2shell RCEs
July 28, 2026
CISA added Langflow CVE-2026-0770 and WordPress wp2shell CVE-2026-63030 to its KEV catalog, setting a July 24 Langflow deadline and August
Qilin Affiliates Exploit PAN-OS CVE-2026-0257 GlobalProtect Bypass
July 28, 2026
Arctic Wolf documented Qilin affiliates exploiting CVE-2026-0257, a PAN-OS GlobalProtect auth bypass, to gain trusted VPN access for double-extortion attacks.
JetBrains Patches TeamCity CVE-2026-63077 CVSS 9.8 RCE Flaw
July 28, 2026
JetBrains patched CVE-2026-63077, a CVSS 9.8 unauthenticated RCE in TeamCity CI/CD servers exploitable via the agent polling protocol without any
AI-Assisted Linux Kernel CVE-2026-53264 Root Exploit Released
July 28, 2026
Lee Jia Jie used AI assistance to discover CVE-2026-53264, a Linux kernel use-after-free enabling local root escalation. A public exploit
Arista VeloCloud CVE-2026-16812 Exploited, CISA Orders Patch
July 28, 2026
Arista confirmed CVE-2026-16812, a CVSS 10.0 OS command injection in VeloCloud Orchestrator, is actively exploited. CISA ordered federal patches by
Dysphoria IoT Botnet Hits 200K Devices With Blockchain C2
July 28, 2026
Dysphoria, successor to the disrupted JackSkid botnet, infected 200,000 IoT devices worldwide and adopted Ethereum and Solana Name Service to
Public Exploit Released for vBulletin CVE-2026-61511 RCE
July 28, 2026
SSD Secure Disclosure released a weaponized unauthenticated RCE exploit for CVE-2026-61511 in vBulletin 6.x, exposing forum sites not yet on
n8n Sandbox Escape GHSA-gv7g-jm28-cr3m Exposes Host OS Commands
July 28, 2026
n8n versions before 2.31.5 let authenticated users escape the expression sandbox via arrow functions and Reflect.get(), executing OS commands on
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.